[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 25.978639] random: sshd: uninitialized urandom read (32 bytes read) [ 26.337674] audit: type=1400 audit(1536355250.198:6): avc: denied { map } for pid=4351 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 26.390709] random: sshd: uninitialized urandom read (32 bytes read) [ 26.966582] random: sshd: uninitialized urandom read (32 bytes read) [ 27.167996] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.43' (ECDSA) to the list of known hosts. [ 32.697303] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 32.815407] audit: type=1400 audit(1536355256.676:7): avc: denied { map } for pid=4365 comm="syz-executor462" path="/root/syz-executor462675731" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 32.819503] WARNING: CPU: 0 PID: 4365 at mm/slab_common.c:1031 kmalloc_slab+0x56/0x70 [ 32.849866] Kernel panic - not syncing: panic_on_warn set ... [ 32.849866] [ 32.857231] CPU: 0 PID: 4365 Comm: syz-executor462 Not tainted 4.19.0-rc2+ #5 [ 32.864499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.873853] Call Trace: [ 32.876447] dump_stack+0x1c9/0x2b4 [ 32.880260] ? dump_stack_print_info.cold.2+0x52/0x52 [ 32.885457] panic+0x238/0x4e7 [ 32.888648] ? add_taint.cold.5+0x16/0x16 [ 32.892802] ? __warn.cold.8+0x148/0x1ba [ 32.896867] ? __warn.cold.8+0x117/0x1ba [ 32.900960] ? kmalloc_slab+0x56/0x70 [ 32.904761] __warn.cold.8+0x163/0x1ba [ 32.908648] ? kmalloc_slab+0x56/0x70 [ 32.912455] report_bug+0x252/0x2d0 [ 32.916153] do_error_trap+0x1fc/0x4d0 [ 32.920044] ? math_error+0x3e0/0x3e0 [ 32.923848] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 32.928690] ? trace_hardirqs_on_caller+0x2c0/0x2c0 [ 32.933705] ? graph_lock+0x170/0x170 [ 32.937615] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 32.942462] do_invalid_op+0x1b/0x20 [ 32.946180] invalid_op+0x14/0x20 [ 32.949633] RIP: 0010:kmalloc_slab+0x56/0x70 [ 32.954041] Code: c5 40 db f2 87 5d c3 b8 10 00 00 00 48 85 ff 74 f4 83 ef 01 c1 ef 03 0f b6 87 60 da f2 87 eb d8 31 c0 81 e6 00 02 00 00 75 db <0f> 0b 5d c3 48 8b 04 c5 80 da f2 87 5d c3 66 90 66 2e 0f 1f 84 00 [ 32.972961] RSP: 0018:ffff8801c2317298 EFLAGS: 00010246 [ 32.978442] RAX: 0000000000000000 RBX: 000000000d7fffd6 RCX: ffffffff832e9d2e [ 32.985708] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000d7fffd7 [ 32.992976] RBP: ffff8801c2317298 R08: ffff8801c197a700 R09: ffffed003b6046de [ 33.000243] R10: ffffed003b6046de R11: ffff8801db0236f3 R12: 00000000006000c0 [ 33.007509] R13: ffff8801c2317938 R14: ffff8801c23173c0 R15: 00000000006000c0 [ 33.014867] ? str_read+0x2e/0x160 [ 33.018411] __kmalloc+0x25/0x720 [ 33.021865] ? hashtab_create+0x11d/0x230 [ 33.026017] ? hashtab_stat+0x1f0/0x1f0 [ 33.029991] ? str_read+0x48/0x160 [ 33.033532] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 33.038676] str_read+0x48/0x160 [ 33.042168] common_read+0x37c/0x560 [ 33.045996] ? user_read+0x5c0/0x5c0 [ 33.049711] ? trace_hardirqs_off_caller+0x2b0/0x2b0 [ 33.054817] ? policydb_read+0x909/0x5f90 [ 33.058978] policydb_read+0xf09/0x5f90 [ 33.062966] ? save_stack+0xa9/0xd0 [ 33.066603] ? save_stack+0x43/0xd0 [ 33.070250] ? user_read+0x5c0/0x5c0 [ 33.073969] ? string_to_av_perm+0xb0/0xb0 [ 33.078283] ? graph_lock+0x170/0x170 [ 33.082089] ? mark_held_locks+0xc9/0x160 [ 33.086240] ? kmem_cache_alloc_trace+0x275/0x730 [ 33.091085] ? __lock_is_held+0xb5/0x140 [ 33.095155] ? security_load_policy+0x174/0x1650 [ 33.099948] ? rcu_read_lock_sched_held+0x108/0x120 [ 33.104977] ? kmem_cache_alloc_trace+0x324/0x730 [ 33.110069] security_load_policy+0x23b/0x1650 [ 33.114660] ? __lock_is_held+0xb5/0x140 [ 33.118800] ? security_change_sid+0x50/0x50 [ 33.123211] ? __alloc_pages_nodemask+0xac5/0xd10 [ 33.128054] ? graph_lock+0x170/0x170 [ 33.131856] ? graph_lock+0x170/0x170 [ 33.135655] ? graph_lock+0x170/0x170 [ 33.139455] ? graph_lock+0x170/0x170 [ 33.143257] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 33.148273] ? vmap_page_range_noflush+0x7fc/0xa80 [ 33.153212] ? lock_downgrade+0x8f0/0x8f0 [ 33.157370] ? lock_release+0x9f0/0x9f0 [ 33.161348] ? check_same_owner+0x340/0x340 [ 33.165671] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 33.170693] ? __check_object_size+0xa3/0x5d7 [ 33.175201] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 33.180738] ? _copy_from_user+0xdf/0x150 [ 33.184889] sel_write_load+0x247/0x460 [ 33.188932] __vfs_write+0x117/0x9d0 [ 33.192650] ? sel_make_policy_nodes+0x1ed0/0x1ed0 [ 33.197582] ? kernel_read+0x120/0x120 [ 33.201472] ? __lock_is_held+0xb5/0x140 [ 33.205543] ? rcu_read_lock_sched_held+0x108/0x120 [ 33.210572] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 33.216126] ? __sb_start_write+0x17f/0x300 [ 33.220455] vfs_write+0x1fc/0x560 [ 33.224064] ksys_write+0x101/0x260 [ 33.227695] ? __ia32_sys_read+0xb0/0xb0 [ 33.231759] ? trace_hardirqs_off_caller+0x2b0/0x2b0 [ 33.236955] __x64_sys_write+0x73/0xb0 [ 33.240960] do_syscall_64+0x1b9/0x820 [ 33.244850] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 33.250215] ? syscall_return_slowpath+0x5e0/0x5e0 [ 33.255143] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 33.260169] ? trace_hardirqs_on_caller+0x2c0/0x2c0 [ 33.265187] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 33.270206] ? prepare_exit_to_usermode+0x291/0x3b0 [ 33.275229] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 33.280242] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 33.285555] RIP: 0033:0x440049 [ 33.288750] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 33.308027] RSP: 002b:00007ffd03e23ca8 EFLAGS: 00000213 ORIG_RAX: 0000000000000001 [ 33.315738] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440049 [ 33.323008] RDX: 0000000000000163 RSI: 0000000020000380 RDI: 0000000000000003 [ 33.330281] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 33.337613] R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004018d0 [ 33.344884] R13: 0000000000401960 R14: 0000000000000000 R15: 0000000000000000 [ 33.352978] Dumping ftrace buffer: [ 33.356609] (ftrace buffer empty) [ 33.360319] Kernel Offset: disabled [ 33.363970] Rebooting in 86400 seconds..